Just your friendly advisor here…
If your organization shares technology with any law enforcement function, there’s a good chance your Microsoft 365 environment cannot satisfy a federal requirement most people have never heard of. Let me walk you through what it is, why it matters, and how to get ahead of it.
I want to start with something that comes up a lot in the conversations I have with Virginia public sector leaders.
Many of these organizations have done a lot of things right. They have invested in good technology. Their IT team works hard. Security is taken seriously.
Then a compliance review comes back with a finding nobody expected, and it has nothing to do with how well the team managed the system.
It has everything to do with the system itself.
That is the conversation I want to have with you today. Because it is happening more often than most people realize, and it is entirely fixable.
The Core Issue
Good security settings cannot fix a platform that was never designed for government work.
Here is something I find myself explaining pretty often…
If your organization shares its Microsoft 365 environment with any law enforcement function, maybe it’s a Sheriff’s Office, a police department, or a dispatch center, the FBI has a specific set of requirements for how that environment must be built and operated.
Not configured. Built.
A standard commercial Microsoft 365 environment is an excellent platform for what it was designed to do. But it was never designed to handle the type of data law enforcement personnel work with every day, warrant records, criminal histories, the information flowing through Virginia’s Criminal Information Network (VCIN).
And here is where it gets important.
It does not matter how strong your security settings are.
Microsoft itself will not provide the legal agreement that federal law requires for law enforcement data unless your organization is operating in its dedicated government cloud environment.
That is not a configuration gap.
That is a foundational one.
The Three Questions That Matter
The federal standard comes down to three questions. Most commercial platforms cannot answer them.
The federal requirement for handling law enforcement data is called the CJIS Security Policy. The policy covers 13 areas, but three are foundational for you right now.
I know that sounds like a lot, but really, it comes down to three questions that any compliance reviewer is going to work through when they look at your environment.
These are the things that matter.
Question 01
Who can actually see your law enforcement data, and have they been properly vetted?
Federal policy says anyone who could access sensitive law enforcement information, including the technology company providing the platform, has to have gone through background screening.
Microsoft’s government cloud meets this requirement. A standard commercial account does not.
Question 02
Where is that data actually being stored, and does your government control it?
Law enforcement data has to stay on U.S. soil, in government-controlled infrastructure.
Microsoft’s government cloud is built for exactly this. A standard commercial account was built for global businesses, and that is a different standard by design.
Question 03
Is there a signed legal agreement between your technology vendor and the Virginia State Police?
There is a specific legal document—the CJIS Security Addendum, approved by the U.S. Attorney General—that a technology vendor has to sign with the Virginia State Police.
Microsoft will sign it for their government cloud. They will not sign it for a commercial account.
That is the line.
Who This Really Affects
When law enforcement shares the environment with the rest of the organization, the compliance question belongs to everyone.
This is the part I really want you to hear, because it is where most organizations are surprised.
When law enforcement shares a technology environment with the rest of the county, city, or municipality, the compliance responsibility does not stay in that department. It belongs to the leadership of the whole organization.
If your County Administrator or City Manager’s office is on the same Microsoft 365 account as the Sheriff (and that is how most Virginia public bodies are set up, because it made complete sense at the time) then the compliance question belongs to everyone at the table.
That is not a criticism of how things got set up. It was a reasonable decision.
One contract, one platform, one IT team managing it all. Simpler. More cost-effective.
Nobody flagged this specific issue at procurement time because most people had not heard of it yet. That is completely understandable.
It just needs to be part of the conversation now.
The Path Forward
Microsoft built a dedicated government cloud for exactly this reason, and the move is more achievable than most people think.
Microsoft’s government cloud (GCC and GCC High) is a separate environment built specifically for government agencies.
Not a premium version of the same thing. A different environment, with different infrastructure, different access controls, and different legal agreements.
It is where Microsoft will sign the agreement the Virginia State Police requires. It is where your data stays under government-controlled infrastructure on U.S. soil.
And it is where your organization can answer all three of those questions with confidence.
Beyond the law enforcement piece (and this is where the real win is!), moving to GCC can also help address obligations around healthcare data, student records for public universities, and financial information, including HIPAA, FERPA, and IRS 1075.
One well-planned move can address a lot at once.
And the good news is that many Virginia public bodies have already done this successfully.
You do not need to be the guinea pig.
One Thing Worth Clarifying Quickly
You may have heard of two versions of Microsoft’s government cloud: GCC and GCC High.
For the vast majority of Virginia counties, cities, municipalities, and public universities, the standard GCC environment is the right destination.
GCC High is built for organizations with specific Department of Defense contract obligations.
Unless that describes your situation, the standard government cloud fully meets your needs, and it is less complex and less costly.
Worth getting this right before you start scoping anything.
The one thing I always tell leadership before their team starts planning this is that moving from a commercial Microsoft 365 account to the government cloud is a real transition.
It is not a settings change.
It takes a solid plan, the right sequencing, and the right partners.
Done carefully, it goes smoothly. Done in a rush, it creates disruption, and nobody likes hearing from end users or stakeholders over and over because something went wrong.
The organizations I have seen get this right are the ones that started before the pressure was on.
And if you want to understand what that planning actually looks like, stay tuned. I will cover that in my next post.
The question worth asking is not just whether you have the right security settings. It is whether your organization is on a platform that will cover the CJIS compliance… built for the work you do. The government cloud is. A commercial account is not.
Where Does Your Organization Stand Today
Take sixty seconds and find your situation below.
Most organizations recognize themselves in at least two of these scenarios. Find the one that best matches your current situation and read what it means.
Your Next Step
We’re happy to have this conversation with you.
If any of this resonated with you, if you have questions about where your organization stands today or what moving to the government cloud would realistically look like, that is exactly the kind of conversation we are built around at Bravo.
We have worked with Virginia public bodies on this specifically.
No pressure. No rushed pitch.
Just a straightforward conversation with people who have been through this before, and a documented picture of where your organization stands that your team can actually act on.
